
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@dossier/mithra-ui
Advanced tools
React component library for the Dossier design system
Set up local development environment:
yarnyarn run build-lib to generate the version file.yarn start to start the dev server.The local dev server gives you a live-reloaded version of the mithra documentation, that you can use to test components while working on them.
If you don't use yarn, you can use npm instead, or install Yarn 1.
Other useful commands:
yarn run build-libyarn run build-docyarn run import-iconsDevelopment happens in feature branches, for example feature/MU-123-add-context-menu. These are merged by pull request to release branches, for example release/v2.next. There is one combined development/release branch for each major version. Later version branches include changes from earlier versions; for example, v1 is included (merged) into v2, but not vice versa.
When making changes that affect users of the library, please add a concise comment about the change at the top of the CHANGELOG file.
To determine which release branch a feature should be merged to, use SemVer (breaking changes → next major, non-breaking changes → next minor or patch).
We use automatic code formatting with Prettier. You should set this up with your editor when contributing.
VS Code: The project already contains configuration that makes the editor format on save, but you must install the Prettier extension. This will be prompted when you open the project.
IntelliJ: Install the Prettier extension, and choose the node_modules Prettier in its settings.
Steps to release on npm:
npm version major|minor|patch to update package.json and create a tagged commit.git push).git push --tags)../iconBuildSrciconBuildSrcyarn run import-iconsThe image snapshot tests take screenshots of test layouts using puppeteer and jest. The images are then compared with previous snapshots using jest-image-snapshot. This alerts us to unintended visual changes to components. If a test fails, an image file will be created, with a visual diff of the change. These tests also run automatically in a bitbucket pipeline for all pull requests. If they fail, you can download the diff images for the failed tests in an artifact from bitbucket.
To run and/or update the tests locally, you must have Docker on your system. The snapshot tests need Docker in order to render exactly the same, regardless of different developer systems and CI.
Before running the tests, be sure you have a dev server running locally. Docker must also be installed.
# Run dev server on your local machine
yarn start
Then you can run the snapshot tests in a container. The following command starts a container and executes all the snapshot tests (against your dev server). The first time you run this command it will spend some time downloading the image and installing node_modules.
# Run tests in the container
yarn test:docker-run
# Or, using jest interactive mode
yarn test:docker-run-interactive
Then if there are any failures, you can see the diffs in __tests__/__image_snapshots__/__diff_output__.
You can update the snapshots by running following command, or through the interactive jest runner terminal ui.
# Run tests in the container
yarn test:docker-run -u
To shut down the container and Docker resources after testing, run:
yarn test:docker-cleanup
Both the local test environment and the bitbucket pipeline use the official puppeteer image. The local environment is managed by Docker compose (see docker-compose.yml).
FAQs
React component library
The npm package @dossier/mithra-ui receives a total of 1,266 weekly downloads. As such, @dossier/mithra-ui popularity was classified as popular.
We found that @dossier/mithra-ui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.